All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-16048
MEDIUMpublished 2026-08-17 15:16 UTC · 18 hours ago · modified 2026-08-17 16:16 UTC
6.3
CVSS / 10
// description
Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697
// weaknesses (CWE)
- CWE-863